Utilize keytool programmatically in a Java servlet to create a certificate/keypair

Question

We need to create an HTTP service that can create and return a certificate signed by a trusted parent certificate. Our initial plan was to use keytool in the bin directory of our jdk in a Servlet using Runtime.exec, but it seems the keytool commands require answers to prompts on the command line.

For example: keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks -keysize 2048 asks a number of questions on the command line.

Our next idea was to use java.security.KeyStore, but I don't see a way to export and persist the store, we will want to keep all our certificates in a jks file. If the web container goes down we definitely need to be able to keep all the PKI artifacts.

Answer 1

Since this was one of the top results in google and I did eventually figure it out here's the answer.

$ java -version
java version "1.7.0_11"
$ keytool -genkey -keysize 2048 \
  -alias tomcat \
  -keyalg RSA \
  -dname "CN=example.com,OU=MyOrgUnit,O=MyOrg,L=Somewhere,S=State,C=US" \
  -storepass Secret -keypass Secret \
  -keystore keystore.jks

Hope this helps others.

Answer 2

Try Portecle . If the GUI can't do it, then simply extract the information from the source.